Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

895 detectors match the current filters.

Download CSV
Type Name Severity Module Data source / event ATT&CK
Analytics NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that NTLM authentication data has been relayed. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Credential Access, Lateral Movement
BIOC Office document embeds a .LNK file An Office process spawned a process with an argument indicating that the document contains an embedded .LNK file. Informational Platform Analytics Process execution Initial Access
Analytics BIOC Office process accessed an unusual .LNK file An attacker may embed a .LNK file in an Office document to execute malicious code. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Execution, Persistence
Analytics BIOC Office process spawned with suspicious command-line arguments An Office process was executed with LOLBIN-like command-line arguments. This behavior is exhibited in the VBA-RunPE tool that executes executables from the memory of Word/Excel/PowerPoint. Low Platform Analytics XDR Agent Defense Evasion
BIOC Office process spawns verclsid.exe A Microsoft Office process launching verclsid.exe may be a sign of phishing. Informational Platform Analytics Process execution Initial Access
BIOC Office process writes an executable file to disk An executable file was written by a Microsoft Office application to disk. Informational Platform Analytics File Execution
BIOC Out of band testing domain connection Connection from web service process to out-of-band-testing domain. Low Platform Analytics Network Initial Access
BIOC Outlook creates an executable file on disk Common weaponized Office document behavior, as Outlook should not create binary files at all. Informational Platform Analytics File Initial Access
Analytics Outlook files accessed by an unsigned process An attacker may use an uncommon and unsigned process to access Outlook data files. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Collection
Analytics BIOC Parsing Rule Error A Parsing Rule error was detected. Medium Platform Analytics Health Monitoring Data Impact
BIOC Password complexity enumeration Attackers may read system files containing password complexity requirements. Informational Platform Analytics Process execution Discovery
BIOC Password policy discovery via command-line tool Attackers may use chage to list the password policy and the user's last access time. Informational Platform Analytics Process execution Discovery
BIOC Password-related Mozilla files were read by a non-Mozilla process Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Informational Platform Analytics File Credential Access
BIOC Perl script connecting to network Perl scripts may be used by attackers to connect to their command-and-control infrastructure. Medium Platform Analytics Process execution Execution
Analytics BIOC Permission Groups discovery commands Permission group discovery command execution. Informational Platform Analytics XDR Agent Discovery
BIOC Permission groups discovery via ldapsearch Attackers may use the ldapsearch command-line tool to gather information about domain groups and their permissions. Informational Platform Analytics Process execution Discovery
BIOC Permissive file privileges were granted Setting readable, writable, and executable permissions for all users may pose a major security risk. Informational Platform Analytics Process execution Defense Evasion
BIOC Persistence through service registration An attacker may add or modify system services to persist on a host. Informational Platform Analytics File Persistence
BIOC Persistence using bashrc files Possible persistency using shell (bash\csh) profile files. Commands in ~/.bashrc are executed on every new shell execution. Informational Platform Analytics File Persistence
BIOC Persistence using cron jobs Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware. Informational Platform Analytics File Persistence
BIOC Persistence via Registry screensaver key change Attackers may install their malware persistently by modifying the value of the screensaver Registry key. Informational Platform Analytics Registry Persistence
Analytics BIOC Phantom DLL Loading An attacker might leverage existing processes missing module loads to load malicious code into trusted processes. Medium Platform Analytics XDR Agent Persistence
BIOC Ping executed with loopback address This seemingly strange "wait" mechanism is often used by malware to stall command execution. Informational Platform Analytics Process execution Defense Evasion
BIOC Ping to a known external IP address Pinging a known external IP address is often used by malware to check internet connectivity. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC Ping to localhost from an uncommon, unsigned parent process Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments. Informational Platform Analytics XDR Agent Defense Evasion
BIOC Plink/SSH reverse tunnel PuTTY link (Plink) / SSH can be used to create encrypted tunnels to communicate back to an attacker's C2 server. Low Platform Analytics Process execution Command and Control
BIOC Pluggable Authentication Modules Access Access to Pluggable Authentication Modules. Informational Platform Analytics Process execution Credential Access
BIOC Pluggable Authentication Modules Modification Modification of Pluggable Authentication Modules. Informational Platform Analytics File Credential Access
BIOC Port Monitor added in Registry Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation. Low Platform Analytics Registry Persistence
Analytics Port Scan The endpoint connected, or attempted to connect, to multiple privileged ports, which are infrequently used by other endpoints (i.e. destination ports that are normally used by many endpoints will not raise this alert). Attackers perform port scans for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port scans using data arriving solely from Cortex agents is incomplete. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, Third-Party Firewalls Discovery
Analytics Port Sweep The endpoint connected, or attempted to connect, to multiple hosts using privileged ports that serve a well-defined function. Attackers perform port sweep for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port sweeps using data arriving solely from Cortex agents is incomplete. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls Discovery
BIOC Possible ARP reconnaissance The ARP binary could be used for network mapping (common with malware). Informational Platform Analytics Process execution Discovery
BIOC Possible ARP reconnaissance via netdiscover Netdiscover is an active/passive ARP reconnaissance tool, which attackers may use to learn your network. Informational Platform Analytics Process execution Discovery
Analytics BIOC Possible binary padding using dd A suspicious dd command ran and added data to a binary. This may indicate binary padding to change the hash of a file. Informational Platform Analytics XDR Agent Defense Evasion
Analytics Possible brute force on sudo user A user executed an unusual amount of sudo commands in a short time period. This may indicate an attempt to guess the sudo password. Informational Platform Analytics XDR Agent Credential Access
Analytics Possible brute force or configuration change attempt on cytool An unusual amount of cytool commands were executed in a short period from a user who doesn't usually run these commands. This may indicate an attempt to guess the Administrator password. High Platform Analytics XDR Agent Credential Access
BIOC Possible C2 via dnscat2 Dnscat2 creates an encrypted C2 channel over the DNS protocol, which attackers may use to hide traffic. High Platform Analytics Process execution Execution
Analytics BIOC Possible code downloading from a remote host by Regsvr32 Regsvr32 may be used to fetch arbitrary code from a remote host and execute it without dropping the payload onto the disk. Known to be used for malicious purposes. Medium Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Possible collection of screen captures with Windows Problem Steps Recorder Windows Problem Steps Recorder (psr.exe), can record screen and clicks. Adversaries may abuse psr.exe to create screen captures and collect them afterward. Medium Platform Analytics XDR Agent Collection
Analytics BIOC Possible compromised machine account A Kerberos TGT for machine account has been used and does not match the hostname. Medium Platform Analytics XDR Agent Execution
BIOC Possible data destruction via dd Attackers may use dd to zero out or write random data to files. Informational Platform Analytics Process execution Impact
Analytics BIOC Possible data obfuscation A command that can be used for file obfuscation was executed with an uncommon command line. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Possible DCSync from a non domain controller Attackers may pose a compromised host as a DC to replicate data to it (DCSync). Low Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent with eXtended Threat Hunting (XTH) Credential Access, Defense Evasion
Analytics BIOC Possible Distributed File System Namespace Management (DFSNM) abuse A possible abuse of Distributed File System Namespace Management (DFSNM). High Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Credential Access
Analytics BIOC Possible DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. This DLL name is usually signed by Microsoft, which might indicate an attacker performing DLL Hijacking. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC Possible DLL Search Order Hijacking An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module. Low Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC Possible Email collection using Outlook RPC Outlook was executed using RPC by an uncommon parent process, this may be an indication of email collection activities. Informational Platform Analytics XDR Agent Collection
BIOC Possible Firefox browser history and bookmarks collection via command-line tool Attackers may collect history and bookmarks details by accessing the Firefox database. Medium Platform Analytics Process execution Discovery
Analytics BIOC Possible IPFS traffic was detected The host attempted to access other nodes in an IPFS manner. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Exfiltration, Initial Access
Analytics BIOC Possible Kerberoasting without SPNs A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes, and is typically a sign of a Kerberoasting attack. The requested service was specified by using a suspicious SPN type, which is often used by Kerberoasting tools to request by SAN instead of SPN. Low Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Credential Access
Analytics BIOC Possible Kerberos relay attack A suspicious local network login was observed, which might indicate on Kerberos relay attack. This attack can lead to privilege escalation by obtaining system privileges on the target. Low Platform Analytics Windows Event Collector, XDR Agent Privilege Escalation
Analytics Possible LDAP enumeration by unsigned process An unsigned process performed multiple different LDAP search queries. This may be indicative of LDAP enumeration. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Discovery
BIOC Possible log destruction using the dd command Possible destruction of system log files using the dd command. Informational Platform Analytics File Defense Evasion
BIOC Possible LSASS memory dump Dumping Lsass.exe (Local Security Authority Subsystem Service) memory to file allows attackers to later extract credentials from the memory dump. High Platform Analytics Process execution Credential Access
Analytics BIOC Possible malicious .NET compilation started by a commonly abused process Attackers may use csc.exe to compile payloads on a compromised machine. Medium Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Possible network service discovery via command-line tool An attacker may use command-line utilities to discover open ports and services on a remote host. Low Platform Analytics XDR Agent Discovery
Analytics BIOC Possible network sniffing attempt via tcpdump or tshark Attackers may monitor network traffic for cleartext credentials or to learn the network's configuration. Low Platform Analytics XDR Agent Credential Access, Discovery
Analytics BIOC Possible new DHCP server A DHCP response was sent from an unknown DHCP server. Attackers may send a DHCP response to a host in his LAN to inject a DNS server, route or WPAD server. Medium Platform Analytics XDR Agent Credential Access
BIOC Possible Oracle enumeration via Oscanner The Oscanner Oracle framework performs enumeration of SIDs, account roles, privileges, hashes, and more. Attackers may attempt to gather this information during the reconnaissance phase. Low Platform Analytics Process execution Discovery
BIOC Possible Oracle enumeration via tnscmd10g The tnscmd10g command-line utility was executed, allowing the enumeration of Oracle DBs. Low Platform Analytics Process execution Discovery
Analytics BIOC Possible path traversal via HTTP request The endpoint received a suspicious URI via an HTTP request that resembles a path traversal attempt. Low Platform Analytics Palo Alto Networks Firewall EAL Logs, XDR Agent Discovery
Analytics BIOC Possible Persistence via group policy Registry keys Group Policy registry keys were read during system startup. This behavior may indicate a persistence mechanism that triggers on reboot to execute malicious code. Medium Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
BIOC Possible ping sweep Ping sweeps are useful tools that can detect which machines are up in the network and can be the step before lateral movement. Medium Platform Analytics Process execution Discovery
Analytics BIOC Possible RDP session hijacking using tscon.exe The executable tscon.exe can be used to hijack other sessions on the same computer. The attacker may use another user's credentials to proceed with the lateral movement or disguise the activity. Medium Platform Analytics XDR Agent Lateral Movement
Analytics BIOC Possible Search For Password Files Attackers often search for files that have passwords in them. Medium Platform Analytics XDR Agent Credential Access
BIOC Possible UAC bypass via Event Viewer Eventvwr.exe normally only spawns mmc.exe. Attackers may use it for bypassing UAC (User Account Control) by having it spawn a different process. Medium Platform Analytics Process execution Privilege Escalation
Analytics BIOC Possible use of a networking driver for network sniffing A process wrote a known networking driver with network sniffing capabilities to disk, attackers can use it to sniff passwords and other credentials from the network. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Credential Access, Discovery
Analytics BIOC Possible use of IPFS was detected The host produced traffic consistent with IPFS. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Exfiltration, Initial Access
BIOC Possible user enumeration via /etc/passwd Attackers may enumerate users by reading the /etc/passwd file. Informational Platform Analytics Process execution Discovery
BIOC Possible user enumeration via finger The Linux 'finger' command performs user enumeration, which attackers may attempt to gather during the reconnaissance phase. Informational Platform Analytics Process execution Discovery
BIOC Possible web shell command execution Possible command execution via a web shell for reconnaissance. Informational Platform Analytics Process execution Persistence
Analytics BIOC Possible webshell file written by a web server process An uncommon file with a web file extension was created, written or renamed by a web server process. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Initial Access, Persistence
BIOC Possible XDG autostart persistency Possible persistency gained by writing or creating a desktop file inside the xdg autostart directory. Informational Platform Analytics File Persistence
Analytics Potential kubelet impersonation attempt A process accessed both the Kubelet credentials and the Kubernetes CA certificate, indicating an attempt to impersonate the node agent and communicate with the API server. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Credential Access
BIOC Potential Network Sniffing Network sniffing related processes were detected. Informational Platform Analytics Process execution Credential Access, Discovery
Analytics BIOC Potential SCCM credential harvesting using WMI detected Attackers or malware may use WMI queries to obtain domain credentials that are used by the SCCM. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Execution, Credential Access
BIOC Potential web shell installation A web-app script file was installed on a web server. This can indicate an installation of web shell. Informational Platform Analytics File Persistence
BIOC PowerShell calling Invoke-Expression argument These PowerShell arguments are often used to run commands with malicious intent. Informational Platform Analytics Process execution Execution
BIOC PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine. Low Platform Analytics Process execution Persistence
BIOC PowerShell downloads files via BITS This PowerShell argument is often used to run commands with malicious intent. Medium Platform Analytics Process execution Persistence
BIOC PowerShell dumps users and roles from Exchange server PowerShell is used to dump users and roles from Exchange servers, this may indicate malicious behavior (e.g. the SolarStorm campaign). Medium Platform Analytics Process execution Discovery
Analytics BIOC PowerShell Initiates a Network Connection to GitHub PowerShell initiates a Network Connection to GitHub with an uncommon command line. This may have legitimate uses, but this technique is frequently used by attackers to serve malicious payloads. Low Platform Analytics Palo Alto Networks Url Logs Execution
BIOC PowerShell is used to execute a CPL file Attackers may use PowerShell.exe to execute a CPL file to achieve Control Panel proxy execution. Informational Platform Analytics Process execution Defense Evasion
BIOC PowerShell is used to modify a timestamp Attackers may use PowerShell.exe to modify the timestamp of a file. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC PowerShell pfx certificate extraction PowerShell was used to extract a pfx certificate file. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Credential Access
BIOC PowerShell possibly attempting to execute as administrator This PowerShell argument is often used to run commands with malicious intent. Informational Platform Analytics Process execution Execution
BIOC PowerShell reverse shell This rule looks for a PowerShell instance that is communicating over known Metasploit ports back to an attacker in cases of reverse shell. Medium Platform Analytics Network Execution
BIOC PowerShell running with download in the command line PowerShell can be used to download malicious content from the internet. Informational Platform Analytics Process execution Execution
Analytics BIOC PowerShell runs suspicious base64-encoded commands Running PowerShell with a base64-encoded payload in the command line is often used by attackers to evade detection. Low Platform Analytics XDR Agent Execution
BIOC PowerShell runs with known Mimikatz arguments These PowerShell arguments are often used to run commands with malicious intent while running Mimikatz, a credential harvesting tool. Medium Platform Analytics Process execution Credential Access
BIOC PowerShell script executed from a temporary directory An attacker may try to avoid detection by executing a PowerShell script from a temporary directory. Informational Platform Analytics Process execution Collection
Analytics BIOC PowerShell suspicious flags Abbreviated flags in PowerShell indicate malicious intent. Medium Platform Analytics XDR Agent Execution
Analytics BIOC PowerShell used to export mailbox contents An attacker may use PowerShell to export the contents of a mailbox as part of the data staging before exfiltration. Medium Platform Analytics Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH) Collection
Analytics BIOC PowerShell used to remove mailbox export request logs An attacker may use PowerShell to remove evidence of an export request for a mailbox as part of the clean-up stage. High Platform Analytics Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH) Execution
BIOC Print Processor Registration Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence. Low Platform Analytics Registry Persistence
BIOC Print spooler set to load new DLL on boot Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API. Informational Platform Analytics Registry Persistence
Analytics BIOC Procdump executed from an atypical directory Procdump.exe is a SysInternals tool used to dump process memory; it can be used to dump lsass.exe memory to extract credentials. Medium Platform Analytics XDR Agent Defense Evasion, Credential Access
BIOC Process attempts to kill a known security/AV tool This process has attempted to use taskkill.exe to terminate a known AV process or security analysis tool. Likely attempt to evade detection. Medium Platform Analytics Process execution Defense Evasion
BIOC Process calls ActiveX Object with a shell command This rule looks for ActiveX being used to run commands on a machine, seen in cases of evasive attacks. Medium Platform Analytics Process execution Execution
BIOC Process changes the Windows logon text This registry key is used to display a legal notice when logging on to the computer. This is used by the DXXD ransomware to notify the user. Medium Platform Analytics Registry Impact